Taal’s Friend – Privacy Notice

Who is responsible for your data

Everybody Taal B.V., trading as Taal Coffee & More, registered with the Dutch Chamber of Commerce (KvK) under number 96939060, J.J. Cremerplein 34, 1054 TL Amsterdam, the Netherlands ("Taal", "we"), is the controller for the personal data processed in connection with the Taal's Friend loyalty program. For any questions or requests about your data, contact us at info@taalcoffee.nl.

The loyalty program runs on our own software, developed and operated by Taal. We do not use an external loyalty platform. Our system is hosted on servers of Hetzner Online GmbH located in Finland, within the European Economic Area.

What data we collect – and what we deliberately don't

We keep the program data-minimal. We process:

Your name, provided at signup
Your email address, provided at signup (stored encrypted; our café staff only ever see a masked version of it)
Your consent choices (marketing emails; wallet push notifications), together with the time and the version of the consent text you agreed to
A card identifier (a random code that links your card to your stamps) and your stamps, rewards, and redemption history, including dates
Security and audit logs of actions taken in our system (for example, when a stamp is added or when staff look up a card)

We do not collect:

Payment card details
What you purchased item-by-item
Your location

Your bank or payment provider is not connected to the loyalty card in any way. Your digital card is issued once and is not updated afterwards, so Apple and Google do not receive information about your stamps or rewards from us.

Why we use your data and on what legal basis

Purpose	Data used	Legal basis (Art. 6 GDPR)
Operating the loyalty program: issuing your card, recording stamps, enabling rewards	Name, email address, card identifier, stamps and rewards balance	Performance of a contract (Art. 6(1)(b))
Service communications by email: important changes to the program or these documents	Name, email address	Performance of a contract; legitimate interest (Art. 6(1)(b), (f))
Marketing emails about offers and news	Name, email address	Your consent (Art. 6(1)(a)) – only if you ticked the box at signup; withdrawable at any time
Wallet push notifications: offers, news and updates sent directly to your Apple Wallet or Google Wallet card	Card identifier	Your consent (Art. 6(1)(a)) – separate optional box at signup; you can withdraw at any time via your wallet settings
Fraud prevention and security	Card identifier, stamp activity, technical and audit logs	Legitimate interest (Art. 6(1)(f))
Aggregated analytics to understand program use (e.g., how many rewards are redeemed)	Aggregated or pseudonymized usage data	Legitimate interest (Art. 6(1)(f))
Compliance with legal obligations (e.g., handling rights requests)	Relevant records	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interest, you have the right to object (see section 7). We never use your data for automated decision-making with legal or similarly significant effects.

Location and notifications – how this actually works

Your digital card can appear on your lock screen when you are near a Taal location. This works through a built-in feature of Apple Wallet and Google Wallet: the locations of our cafés are stored on the card, and your own device compares them with its position. This happens entirely on your device.

If you gave consent at signup, we may also send push notifications directly to your wallet card — for example to share offers, news, or reward updates. These are delivered via Apple Wallet or Google Wallet and do not require a separate app.

You can turn off wallet push notifications at any time without losing your stamps or rewards:

Apple Wallet: open the card → tap "…" → switch off "Allow Notifications"
Google Wallet: open the card → tap the menu → disable notifications for this pass
Via us: email info@taalcoffee.nl and we will disable them on our end

You are always in control of all notifications, without losing your stamps:

Apple Wallet: open the card, tap the "…" button, switch off "Allow Notifications"
Google Wallet: open the card, tap the menu, and disable notifications for this pass
Promotional emails: use the unsubscribe link in any email, or contact us
Everything at once: remove the card from your wallet – this ends participation and all notifications

Who receives your data

Hetzner Online GmbH — our hosting provider, located in Finland (EEA), processes data only as necessary to provide server infrastructure
Apple and Google — receive only the static card data (card identifier and café locations) at the moment the card is issued, to display it in your wallet; if you have consented to push notifications, they also act as the delivery channel for those messages
Our email service provider — used to send transactional and, where consented, marketing emails; details available on request

All data is stored within the European Economic Area. We do not sell your data and do not share it with third parties for their own marketing.

How long we keep your data

Loyalty data (name, email, card, stamps)

For as long as you participate. If your card is unused for 24 consecutive months, it is deactivated and your data is deleted or anonymized.

Marketing & notification consent records

Until you withdraw consent, plus a limited record of the withdrawal itself to prove compliance.

Card removal or deletion request

Deletion within 30 days, unless a legal obligation requires limited retention.

Security and audit logs

Only as long as necessary for security and troubleshooting, and no longer than 12 months.

Your rights

Under the GDPR (AVG) you have the right to:

✓ Access your data

✓ Have it corrected or deleted

✓ Restrict or object to processing

✓ Receive a copy in a portable format

✓ Withdraw consent at any time

✓ Object to direct marketing — we will stop immediately

To exercise any right, email us at info@taalcoffee.nl or ask in-store; we respond within one month.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), although we would appreciate the chance to resolve your concern first.

Changes to this notice

We may update this notice from time to time, for example when the program or the law changes. The current version is always available at taalcoffee.nl/privacy and via your digital card. We will inform you of material changes by email (if you have consented to emails) or by posting a notice in the café.